1. Technical Field
The invention relates generally to electronic transaction technology. More particularly, this invention relates to a system and method for secure online transactions.
2. Description of the Prior Art
The explosive growth of the Internet is changing the ways in which we communicate, conduct business, and pursue entertainment. A few years ago, electronic commerce (E-commerce) was just an interesting concept. By 1999, however, it had become the hottest thing around. Today, not only are consumers buying an enormous volume of goods or services over the Internet, but the business-to-business E-commerce has taken off as well.
As online transactions grow, a higher rate of charge-backs also grows due to fraudulent transactions. According to one report, online fraud is ten times higher than in the real world. Merchants bear the cost of fraud 10 to 15 percent of the time if a credit card is present, while E-commerce retailers bear the cost about 25 percent of the time.
The security of online transactions has become a major concern for the user and the merchant, as well as for the credit card issuers. If fraudulent transactions are minimized, the confidence involved parties have in online transactions can be greatly increased, and online transactions can make a great jump in e-commerce world.
In responding to that need, several approaches have been developed. For example, MasterCard and VISA have cooperatively developed the Secure Electronic Transactions (SET) Protocol. SET combines ideas from the previous proposals by MasterCard and VISA. The SET Secure Electronic Transaction™ protocol is an open industry standard developed for the secure transmission of payment information over the Internet and other electronic networks. SSL Secure Socket Layer (SSL) (developed by Netscape Communications Company) is a standard that encrypts data between a Web browser and a Web server. SSL does not specify what data are sent or encrypted. In an SSL session, all data sent are encrypted.
SET uses a system of locks and keys along with certified account IDs for both consumers and merchants. Then, through a unique process of encrypting or scrambling the information exchanged between the shopper and the online store, SET ensures a payment process that is convenient, private and, most of all, secure.
SET has numerous advantages. For example, it establishes industry standards to keep the user's order and payment information confidential, increases integrity for all transmitted data through encryption, and provides authentication that a cardholder is a legitimate user of a branded payment card account. However, to deploy SET, digital certificates are required for all participating parties.
VISA has unveiled another system that lets a user attach a password to his credit card number called 3D Secure. This ensures that if a thief gets hold of the user's card number the card cannot be used over the Internet unless the thief has the password that only the user knows. To take advantage of 3D Secure, the user must go to the site of issuer of his VISA card and register a password for the card. This enrollment process takes the user's password and attaches it to his card number. When he visits an online merchant and makes a purchase by entering the VISA credit card number, he is prompted for his password for the card before going through the regular transaction.
MasterCard also developed Secure Payment Application™ (SPA), a solution for securing credit and debit payments between the user, online merchants and members, to address the issue of cardholder authentication. SPA is an issuer-based security scheme that takes advantage of MasterCard's Universal Cardholder Authentication Field (UCAF) infrastructure. UCAF is a universal, multipurpose data transport mechanism implemented by merchants for collecting authentication information generated by issuers and cardholders. Once collected, this information is communicated to the issuer in the payment authorization request and provides explicit evidence that it is the legitimate cardholder who originated the transaction. UCAF supports a variety of issuer security and authentication approaches including SPA, smart cards and more.
SPA adds a significant security component by including a unique cardholder authentication value for each transaction that can be verified by the issuer during payment authorization. Merchants are responsible for collecting and passing this cardholder authentication value, and including it along with other payment information, at the time of authorization.
To ensure proper cardholder authentication, the prior art approaches require that users go through an added authentication step to complete their purchase. Currently this step adds confusion and is cumbersome for the user to understand. Therefore, user adoption remains the biggest problem for these schemes.
What is desired is a secure solution to make the added authentication step intuitive and easy to understand by the user.
What is further desired is to make the secure solution have a user interface that resembles the offline credit card transactions, so that it may be widely accepted by the online world.
What is further desired is a solution that integrates with the credit card issuer when a personal identification number is required for the user to perform online transactions by the credit card issuer.